AI in AML and Transaction Monitoring: What Regulators Expect

Transaction monitoring is one of the most expensive parts of an anti-money laundering (AML) programme, and one of the least efficient. Rule-based systems generate large numbers of alerts, and many turn out to be false positives that analysts must still review. Artificial intelligence (AI) and machine learning promise to cut that noise and find patterns that fixed rules miss. Regulators have broadly welcomed the idea, but they have also been clear about the conditions: you need good data, you must be able to explain what the model does, and humans remain accountable. This guide explains what AI can and cannot do in AML, what the main regulators have said, and how a firm or finance team should approach it. It is aimed at accountants, compliance officers and students, not data scientists.

Where AI is used in AML today

The Financial Action Task Force (FATF) set out the main uses in its July 2021 report, Opportunities and Challenges of New Technologies for AML/CFT. According to that report, machine learning offers the greatest advantage, because it can learn from existing systems, reduce manual monitoring work and cut false positives. The report also describes these uses:

• Transaction monitoring. Models can group customers with similar behaviour and focus alerts on patterns that look unusual for that group, rather than relying only on fixed thresholds.
• Identity verification. AI-based tools, including biometrics and liveness detection, can help verify customers remotely.
• Risk assessment. AI can analyse data in real time, help spot emerging risks and test manual risk ratings.
• Regulatory change. Models can scan large volumes of regulatory text and shortlist the changes that matter.
• Supervision. Automated reporting can give supervisors detailed data in bulk.

Newer tools use generative AI to summarise alerts, draft investigation notes or suggest narrative text for suspicious activity reports. These are not covered in the FATF report, and regulators have not issued detailed rules for them, so treat them as assistive tools whose output must be checked by a person.

What the regulators have said

FATF. The 2021 report lists explainability and interpretability as a key challenge for both industry and regulators, and says technology will not improve effectiveness without accurate, high-quality data. Its recommendations are to adopt AI responsibly and proportionately, keep human analysis in the loop and avoid over-reliance on technology, test effectiveness continuously and recalibrate tools that do not meet their purpose, and make sure tools comply with data protection and privacy standards. FATF says it does not endorse specific technologies or providers.

United States. On 3 December 2018 the Federal Reserve, FDIC, FinCEN, the National Credit Union Administration and the Office of the Comptroller of the Currency issued a joint statement encouraging banks to "consider, evaluate, and, where appropriate, responsibly implement innovative approaches" to meet their Bank Secrecy Act obligations. The agencies said the statement does not change existing requirements or create new supervisory expectations, and that banks which choose not to pursue innovation will not be penalised or criticised for that choice.

UK and EU. According to a Sanction Scanner summary, the UK Financial Conduct Authority relies on existing rules rather than writing AI-specific ones, and the EU's AI Act (Regulation (EU) 2024/1689) classifies AI systems by risk. Not every AML tool is automatically high-risk, and the classification depends on what the system does. The AI Act timetable has been the subject of change proposals, so check the current dates and your own use case with legal advice. Our guide to AML governance, testing and model effectiveness explains how to evidence that a model works.

The main risks

• Black-box decisions. If you cannot explain why a model flagged or ignored a customer, you will struggle to justify the decision to a supervisor or a court.
• Poor data. A model trained on incomplete or inaccurate data will learn the wrong patterns. Data quality is usually the first project, not the model.
• Bias and exclusion. FATF raises concerns about unintended consequences and the exclusion of underserved groups. A tool that wrongly flags certain customer types can lead to unfair de-risking.
• Over-reliance. Automation can lull staff into trusting alerts or non-alerts without thinking. Human review stays essential.
• Privacy and security. Feeding customer data into external AI tools can breach data protection law or client confidentiality.

A sensible approach for firms and finance teams

1. Start with the problem. Identify where you lose most time, such as alert backlogs, onboarding checks or sanctions screening, and set a measurable goal.
2. Fix the data. Clean customer and transaction records before adding any model.
3. Pilot in parallel. Run the new tool alongside your existing process and compare results before switching over.
4. Document the logic. Record what the model does, what data it uses, who approved it, and how often it is reviewed.
5. Keep humans responsible. Name the people who review alerts and sign off decisions. See our guide to transaction monitoring and alert investigation for what good investigation looks like.
6. Test and recalibrate. Check false-positive and false-negative rates regularly, and record changes.
7. Check vendors. Ask where data is stored, how the model is validated and what happens when it fails.

What this means for accountants

Most accountancy firms do not run bank-scale monitoring systems, but the same ideas apply to client onboarding, screening and ongoing monitoring. AI can help automate identity checks and sanctions matching, as covered in our guide to sanctions screening and alert resolution. It cannot replace the judgement that a partner or compliance officer must exercise, and it does not remove the firm's legal responsibility for its decisions. For professionals who want to build skills in this area, see our CPD courses.

Frequently asked questions

Can AI replace AML analysts?

No. FATF recommends keeping human analysis in the loop, especially for specific alerts and higher-risk areas. AI changes where analysts spend their time, but accountability stays with people.

Do regulators require firms to use AI?

No. The 2018 US joint statement says banks that choose not to pursue innovative approaches will not be penalised or criticised for that choice, and does not create new requirements.

Is generative AI safe to use for suspicious activity reports?

It can help draft text, but a trained person must check every statement for accuracy, and you must not enter confidential client data into tools that are not approved by your firm.

What is explainability?

It is the ability to describe, in plain language, why a model produced a particular result. FATF calls it a key challenge for industry and regulators.